LangGraph for Python 0.4

Apply to the legacy LangGraph 0.4 line with the included Python baseline. When the application uses LangChain, also apply the LangChain for Python prompt for its installed version.

Prompt injection and graph state

• Keep user, retrieved, tool, and stored-memory content as untrusted data, separate from developer instructions. Prompt injection must not change the principal, tool permissions, routing policy, or approval state.
• Build incoming messages in application code as user content. Do not accept client-selected system roles, fabricated AIMessage.tool_calls, or arbitrary message IDs: add_messages replaces existing messages with matching IDs as well as appending new messages.
• Validate external graph inputs and node updates explicitly. TypedDict, MessagesState, reducers, and compile() are not authorization or complete runtime validation. Use narrow input/output schemas, and keep identity, policy, and approval fields outside user-writable state channels.
• Keep graph topology, conditional routing, Command.goto, Command.update, and Send destinations under application control. Allowlist model-selected routes and validate their arguments; a valid node name does not grant permission to execute it.

Tool authorization and human approval

• Enforce tool authorization inside each tool immediately before its effect, checking the current authenticated principal, operation, arguments, and resource. ToolNode dispatch, tool schemas, and model selection do not enforce application permissions.
• Populate RunnableConfig.configurable, InjectedState, and